Windows 8 Windows Update: HUGE SECURITY THREAT

[IHateWindowsEight]

That's right: It keeps setting all these Microsoft programs to the "allowed" list. I don't use them, I don't need them, and I have half a mind to destroy their respective directories, because windows seems to want to hang on to them for some ungodly reason.

Every time I update windows, a specific handfull of elements in the firewall ruleset pertaining to a select few programs is set to "allowed" without notice or warning. This appears to happen whenever I check for, or update windows. This is a HUGE security threat: I would have half a mind to write a virus just to prove this. If I know that these rulesets are allowed, you can be damn well sure a hacker does.

I can see it now: the next big virus, exploiting this and spoofing it's identity as one of these programs' connections and infecting millions.

Where is a windows rep when you need one?? I want these programs GONE. Non-existent, exterminated, purged, over-written, DELETED: permanently. I never use them, I never needed them, I never will need them. I don't use a laptop to browse "bing", or use the "food and drink" programs. It's wasted space, and it's irritating.

 

[Mike]

If you are this concerned about security, firewall these ports using a third party program or at the router level. Microsoft likely considers these essential services for the operating system, so, yes, I could see how this could be considered annoying. This is not an official Microsoft website. Do what needs to be done.

 

[kemical]

Meh...

 

[sirloyne]

Clearly you don't understand that Big Brother M$ knows what you want more than you do. It's called progress, you Luddite! Ask any administrator here.

 

[kemical]

It's true.......

 

[IHateWindowsEight]

I'll give "Big Brother" the birdy then. ,l,,

In the mean time, I will experiment...

 

[IHateWindowsEight]

So gues what I found:

C:\System Volume Information\tracking.log

Yep. I used a program I wrote to find it. When I opened it (through my program), it appeared to be encrypted, so it's contents are unknown.

Interestingly enough, I attempted to locate it with Administrative Command prompt:

C:\System Volume Information>dir
Volume in drive C is ACER
Volume Serial Number is FEA0-5C6B

Directory of C:\System Volume Information

11/26/2013  01:07 AM                76 IndexerVolumeGuid
02/05/2013  07:59 PM    <DIR>          WindowsImageBackup
              1 File(s)            76 bytes
              1 Dir(s)  395,284,774,912 bytes free

C:\System Volume Information>dir *.log
Volume in drive C is ACER
Volume Serial Number is FEA0-5C6B

Directory of C:\System Volume Information

File Not Found

The only way you would be able to access this file is if you knew that it was there, or you had a program that could find it (like me). Interesting huh?

I wonder what will happen if I delete it's contents. Most likely nothing, mabey somthing... I'll backup and tell you! ;D

 

[sirloyne]

Maybe that's where all the information is kept that M$ sells to the NSA.
http://www.theguardian.com/world/2013/jul/11/microsoft-nsa-collaboration-user-data

 

[davehc]

The tracking log is mainly used by the "The Distributed Link Tracking Client service". It is present in the root of each and every volume. It is also used by the indexing service. It also logs info for a DFS , where requested, and keeps a track of domain links.
In the same folder, in conjunction with the tracking log, the sytem restore point information is also kept
The folder contains other items relevant to the operation, This is mine, for example:

 

[Mike]

Clearly you don't understand that Big Brother M$ knows what you want more than you do. It's called progress, you Luddite! Ask any administrator here.

This is a gross-distortion of our policies. Your computer is yours. Do with it what you please. Everyone is entitled to their own opinion but flame baiting is quite prohibited.

 

[IHateWindowsEight]

@Mike:

I'm a cynic at heart, and I go by the phrase: "Power corrupts, and absolute power corrupts absolutely."

Until any big corporation, like Microsoft, proves that they are on our side with a gesture torward us, at their own risk, I maintain that they probably do some things that even you don't know about, mike-y.

That said, I have no begun experimentation to purge these programs because I am finishing a programming project (you saw the screenshot up there). Wieghing in at 7,000 lines, it is my most ambitous solo project yet, but it will give me a LOT of power ( hehehe).

Once that program is finished, I will start tackling this issue. For now, a temporary solution will be offered:

1. Hold down the windows key, and press the 'X' button.
2. Click on "control Panel"
3. Click on System and Security
4. Firewall
5. Advanced settings (left side of the screen)
6. Delete ALL OF YOUR RULES. You don't need them.
7. Go back to basic firewall settings, and click "Turn Windows Firewall on or off":

8. Check "Turn on windows firewall" for both public and private
9. Check both "Notify me when windows firewall blocks a new app" and "Block all incoming connections"
10. Go back to advanced settings now
11. Block these programs:

12. You can delete everything else, you don't need them. Your computer will prompt you if they need access, otherwise, you will want to block them. Do this for both inbound and outbound connections. That picture shows outbound, not all of those programs may be in inbound.

13. on the left hand side, there is a list:

Right click on "Windows Firewall with Advanced..."

14. Block all Connections:

15. Now, right click again on that:

16. Click "Export Policies"
17. Save this file somwhere where you know where it is.

18. When windows screws you over, you can import these "policies" and all of your rules should be restored! Hopefully, if I succeed at purging these programs (no garuntees) I can offer a more permanent solution.

The changes made shouldn't affect your system in any way. A strict firewall is the first step to preventing infection of viruses, especially when accessing publicly available routers. In almost all cases, it is the first line of defense. Don't take it lightly!!

 

[IHateWindowsEight]

Also, I'm surprised at microsoft, for making the firewall such a hurdle to make truely secure. At best, the default settings are error proof, but not virus proof.